Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a central authentication server with OpenLDAP set up and populated, and Kerberos 5, also populated.

On an Ubuntu LTS machine, I set up nslcd and kerberos client stuff. This way, issuing the

id gergely.polonkai

tells me I'm gergely.polonkai(10000) in group engineering(10000). Also, issuing

kinit gergely.polonkai

asks for my password, and creates my keychain (klist shows my TGT).

Thus, I assume every bit works fine. But when I add kerberos stuff to pam:

auth sufficient
account sufficient
session optional

the logs say gergely.polonkai authenticated successfully, then says gergely.polonkai is unknown to the underlying authentication module.


getent passwd gergely.polonkai

gets me the correct data. However

getent shadow gergely.polonkai

tells me nothing (trying both as root).


adding shadowAccount objectClass to the user fixed the shadow problem. However, the original error still persists.

Am I missing something?

share|improve this question
The first thing I would try is a more straightforward username that is 8 chars or less. If that works try a longer username that is just a-z. It may be that the pam modules are not handling the username correctly. '.' is a special char that needs quoting in earlier versions of kerberos and it may be causing problems in the pam module code. – Fred the Magic Wonder Dog Feb 23 '14 at 21:49
My packages are recent (kinda. it’s a CentOS 6.4). The answer was a bit more obvious; see my own answer below. – GergelyPolonkai Feb 24 '14 at 20:46

It seemed that I was missing something fundamental. After messing up my whole PAM and NSS configuration by hand, I reinstalled the machine (it was a fresh install before my messing). After installing all the necessary packages I did before, running one single magic command by hand did the trick:


As soon as I get back to that machine tomorrow, I will post the resulting pam.d files.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.